Settings

Atlas reads its settings once, when it starts, from four places, each winning over the one before: the default, the home’s config.toml, an ATLAS_* variable, and a command-line flag. A variable is named after the setting’s place in the file: [server] port is ATLAS_SERVER_PORT, and a blank variable counts as unset.

An unknown key in config.toml stops Atlas with an error, so a typo never passes in silence; an unknown ATLAS_* variable is only reported. A secret never goes in the file: it comes from its variable, which Atlas removes from its environment once read, so no command the agent runs inherits it. The settings marked on the settings screen also change from the app, with no restart. A plugin keeps its own settings, changed with atlas plugins set.

[server]

Key	Value	Default	Variable	What it does
host	text	"127.0.0.1"	ATLAS_SERVER_HOST	The address the server listens on: this machine only, unless told otherwise. 0.0.0.0 belongs only inside a container or behind a firewall.
port	whole number	18790	ATLAS_SERVER_PORT	The port the server listens on. 0 lets the system choose one.
token	secret	unset	ATLAS_SERVER_TOKEN	What a client presents to be let in, from ATLAS_SERVER_TOKEN, set by whoever starts the server. Unset, the server makes a fresh one nobody knows.

[log]

Key	Value	Default	Variable	What it does
level	one of DEBUG, INFO, WARNING, ERROR	"INFO"	ATLAS_LOG_LEVEL	The least serious lines the log keeps: DEBUG, INFO, WARNING or ERROR.
file	true or false	true	ATLAS_LOG_FILE	Also write logs/atlas.log. A container usually turns it off and reads stderr instead.

[vault]

Key	Value	Default	Variable	What it does
key	secret	unset	ATLAS_VAULT_KEY	The vault key itself (AGE-SECRET-KEY-1...). Only from the environment, never from a file.
key_file	path	unset	ATLAS_VAULT_KEY_FILE	A file holding the vault key, such as a Docker secret mounted read-only.

[model]

Key	Value	Default	Variable	What it does
provider	text	unset	ATLAS_MODEL_PROVIDER	The provider of the conversation’s model, such as openai or openrouter. On the settings screen.
name	text	unset	ATLAS_MODEL_NAME	The model’s id at that provider. Unset, the provider’s default model answers. On the settings screen.
effort	text	unset	ATLAS_MODEL_EFFORT	How hard a reasoning model thinks (low, medium, high…). Unset, the model decides. On the settings screen.

[trust]

Key	Value	Default	Variable	What it does
deny	list of text	[]	ATLAS_TRUST_DENY	Commands the agent must never run, as shell-style globs (git push --force*), matched case-insensitively; blocked even in auto mode. On the settings screen.
ask	list of text	[]	ATLAS_TRUST_ASK	More commands that always ask the user first, as shell-style globs (git push*), on top of the outward actions Atlas asks about on its own. They ask even in auto mode. On the settings screen.
ask_skip	list of text	[]	ATLAS_TRUST_ASK_SKIP	Globs of commands Atlas’s own outward rules leave alone (gh issue comment*): the user’s way to take an action off the default list. The user’s ask rules still apply. On the settings screen.
approval_timeout	whole number	300	ATLAS_TRUST_APPROVAL_TIMEOUT	Seconds an approval waits for the user before it counts as refused (60 was too tight for a phone notification). On the settings screen.

[workspace]

Key	Value	Default	Variable	What it does
folder	path	unset	ATLAS_WORKSPACE_FOLDER	Where the file tools and commands start. Unset, the user’s home folder. On the settings screen.

[time]

Key	Value	Default	Variable	What it does
zone	text	unset	ATLAS_TIME_ZONE	The IANA zone routines run in (America/Sao_Paulo). Unset, the system’s. On the settings screen.

[browser]

Key	Value	Default	Variable	What it does
chrome	list of text	[]	ATLAS_BROWSER_CHROME	The program that runs Chrome, Edge or Chromium, and the arguments before its own (step 14). Unset, the first one found where they install.

[marketplace]

Key	Value	Default	Variable	What it does
repository	text	"marqueskaio/atlas-marketplace"	ATLAS_MARKETPLACE_REPOSITORY	The marketplace’s repository on GitHub, owner/name.
branch	text	"main"	ATLAS_MARKETPLACE_BRANCH	The branch Atlas reads it from.
archive_url	text	"https://codeload.github.com/{repo}/tar.gz/{ref}"	ATLAS_MARKETPLACE_ARCHIVE_URL	Where a repository’s archive is fetched, with {repo} and {ref}: a mirror’s address, or a test’s.
raw_url	text	"https://raw.githubusercontent.com/{repo}/{ref}/{path}"	ATLAS_MARKETPLACE_RAW_URL	Where one file of a repository is read, with {repo}, {ref} and {path}.